consul/test/integration/consul-container/assets/Dockerfile-consul-dataplane

# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1

ARG CONSUL_DATAPLANE_IMAGE
ARG CONSUL_IMAGE

# Docker doesn't support expansion in COPY --copy, so we need to create an intermediate image.
FROM ${CONSUL_IMAGE} as consul

FROM ${CONSUL_DATAPLANE_IMAGE} as consuldataplane

USER root

# On Mac M1s when TProxy is enabled, consul-dataplane that are spawned from this image
# (only used in consul-container integration tests) will terminate with the below error.
# It is related to tproxy-startup.sh calling iptables SDK which then calls the underly
# iptables. We are investigating how this works on M1s with consul-envoy images which
# do not have this problem. For the time being tproxy tests on Mac M1s will fail locally
# but pass in CI.
#
# Error setting up traffic redirection rules: failed to run command: /sbin/iptables -t nat -N CONSUL_PROXY_INBOUND, err: exit status 1, output: iptables: Failed to initialize nft: Protocol not supported
RUN microdnf install -y iptables sudo nc \
 	&& usermod -a -G wheel consul-dataplane \
 	&& echo 'consul-dataplane ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers

COPY --from=consul /bin/consul /bin/consul

COPY tproxy-startup.sh /bin/tproxy-startup.sh
RUN chmod +x /bin/tproxy-startup.sh && chown root:root /bin/tproxy-startup.sh

USER 100
NET-5657 - consul-containers test for explicit upstreams (#18952) * Explicit container test * remove static resources * fix passing serviceBindPorts * WIP * fix explicit upstream test * use my image in CI until dataplane is fixed. * gofmt * fixing reference to v2beta1 in test-containers * WIP * remove bad references * add missing license headers * allow access internal/resource/resourcetest * fix check-allowed-imports to append array items * use preview image for dataplane * revert some inadverntent comment updates in peering_topology * add building local consul-dataplane image to compatibility-tests CI * fix substitution in CI * change upstreams to destinations based on incoming change * fixing use of upstreams in resource update * remove commented out lines and enable envoy concurrency on dataplane. * changes to addess PR feedback * small fixes --------- Co-authored-by: Eric <eric@haberkorn.co> 1 year ago			`# Copyright (c) HashiCorp, Inc.`
			`# SPDX-License-Identifier: BUSL-1.1`

			`ARG CONSUL_DATAPLANE_IMAGE`
Add traffic permissions integration tests. (#19008) Add traffic permissions integration tests. 1 year ago			`ARG CONSUL_IMAGE`

			`# Docker doesn't support expansion in COPY --copy, so we need to create an intermediate image.`
			`FROM ${CONSUL_IMAGE} as consul`
NET-5657 - consul-containers test for explicit upstreams (#18952) * Explicit container test * remove static resources * fix passing serviceBindPorts * WIP * fix explicit upstream test * use my image in CI until dataplane is fixed. * gofmt * fixing reference to v2beta1 in test-containers * WIP * remove bad references * add missing license headers * allow access internal/resource/resourcetest * fix check-allowed-imports to append array items * use preview image for dataplane * revert some inadverntent comment updates in peering_topology * add building local consul-dataplane image to compatibility-tests CI * fix substitution in CI * change upstreams to destinations based on incoming change * fixing use of upstreams in resource update * remove commented out lines and enable envoy concurrency on dataplane. * changes to addess PR feedback * small fixes --------- Co-authored-by: Eric <eric@haberkorn.co> 1 year ago
			`FROM ${CONSUL_DATAPLANE_IMAGE} as consuldataplane`
Add traffic permissions integration tests. (#19008) Add traffic permissions integration tests. 1 year ago
			`USER root`

			`# On Mac M1s when TProxy is enabled, consul-dataplane that are spawned from this image`
			`# (only used in consul-container integration tests) will terminate with the below error.`
			`# It is related to tproxy-startup.sh calling iptables SDK which then calls the underly`
			`# iptables. We are investigating how this works on M1s with consul-envoy images which`
			`# do not have this problem. For the time being tproxy tests on Mac M1s will fail locally`
			`# but pass in CI.`
			`#`
			`# Error setting up traffic redirection rules: failed to run command: /sbin/iptables -t nat -N CONSUL_PROXY_INBOUND, err: exit status 1, output: iptables: Failed to initialize nft: Protocol not supported`
			`RUN microdnf install -y iptables sudo nc \`
			`&& usermod -a -G wheel consul-dataplane \`
			`&& echo 'consul-dataplane ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers`

			`COPY --from=consul /bin/consul /bin/consul`

			`COPY tproxy-startup.sh /bin/tproxy-startup.sh`
			`RUN chmod +x /bin/tproxy-startup.sh && chown root:root /bin/tproxy-startup.sh`

			`USER 100`